T09 · Insecure Skill Coding Practices
Error
- Location
scripts/x402-fetch.mjs:38- Finding
Automatic x402 payments can be authorized for arbitrary network destinations
- Content
View full analysis
- Remediation
View remediation
Security audit
x402 Private Web Tools
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it gives a wallet-signing payment tool too much unsupervised authority.
Review carefully before installing. Use only a dedicated low-balance wallet, avoid passing secrets in command-line arguments, do not send confidential URLs or headers, and only invoke the payment fetcher against destinations you explicitly trust.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wallet-gen.mjs:17- Finding
Wallet private key is exposed through terminal output and unsafe input channels
- Content
View full analysis
EVM private key (hex, with or without 0x prefix) --key-file File containing the private key --method HTTP method (default: GET) --body Request body (for POST) --header Extra header (repeatable) --quiet Suppress stderr info messages Environment: X402_PRIVATE_KEY EVM private key (fallback if --key not provided) X402_KEY_FILE Key file path (fallback if --key-file not provided) ``` From `SKILL.md`: ```bash export X402_PRIVATE_KEY=$(cat ~/.x402-client/wallet.key) ``` ### Technical Analysis The wallet generator always writes the newly generated private key to standard output, including when the caller uses `--out` to save it to a mode-`0600` file. Terminal output may be retained in Agent transcripts, CI logs, shell session recordings, terminal scrollback, or diagnostic systems. The request CLI also supports passing the key through `--key`. Command-line arguments can be exposed through shell history, process inspection, monitoring agents, audit logs, and error reports. The documentation recommends exporting the key as an environment variable. Environment variables are safer than command-line arguments in some environments, but they can still be inherited by child processes and exposed through crash diagnostics or process-inspection mechanisms. The mode-`0600` permission used when `wallet-gen.mjs` creates an output file is a positive control, but it does not mitigate the uncondition ...[truncated 983 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:25- Finding
Mutable npm dependencies are installed without a lockfile or integrity pinning
- Content
View full analysis
package.json << 'EOF' { "name": "x402-client", "version": "1.0.0", "private": true, "type": "module", "dependencies": { "@x402/fetch": "^2.3", "@x402/evm": "^2.3", "viem": "^2.0" } } EOF npm install --quiet 2>&1 | tail -3 ``` Related guidance from `SKILL.md`: ```bash # Install npm install -g x402-tools-mcp # Run (set your wallet key) X402_PRIVATE_KEY=0x... x402-tools-mcp ``` ### Technical Analysis The setup script creates a new `package.json` with caret version ranges and runs `npm install` without a committed lockfile. Consequently, installations performed at different times can resolve to different package versions that were not present during the Skill audit. npm packages may execute lifecycle scripts during installation unless those scripts are disabled. At runtime, the selected x402 dependencies receive access to a wallet signer and participate in payment authorization. A compromised package release, maintainer account, transitive dependency, or registry response could therefore have security consequences beyond ordinary application behavior. The documentation additionally recommends a global installation of `x402-tools-mcp` without a version pin and then supplies that process with the wallet private key. Global installation expands the affected environment and gives an unaudited package direct access to a high-value secret. No evidence establishes that the named packages are currently malicious. The vulnerability is the mutable, insufficiently reproducible trust boundary used to install and run security-sensitive dependencies. ### Attack Path 1. An npm maintainer account, package release, transitive dependency, or registry distributi ...[truncated 1177 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill exposes capabilities that rely on environment secrets and outbound network access, but the manifest does not declare any explicit tool scope or permissions. This can cause agents or users to invoke a networked, payment-capable skill without clear guardrails, increasing the chance of unintended data egress or misuse of wallet credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages sending search queries, URLs, and scrape targets to an external service, but it does not prominently warn that user-supplied data will leave the local environment and be transmitted to a third party. It also omits a strong warning that screenshot output may be written to disk, which can create privacy and data-handling risks for sensitive targets.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **Parameters:** `url` (required), `format` (png|jpeg, default png), `width` (320-3840), `height` (200-2160), `fullPage` (true|false), `quality` (1-100, jpeg only) **Returns:** Binary PNG or JPEG image. Use `--save <file>` to write to disk. ## MCP Server
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The service reference documents scraping and screenshot endpoints that send user-supplied target URLs and retrieved page content to an external gateway, but it does not clearly warn users about the privacy and data-handling implications. In an agent context, this can cause sensitive internal URLs, authenticated resources, query terms, or scraped content to be transmitted to a third party unexpectedly, increasing data exposure risk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This shell script creates an install directory, writes a package.json file, runs npm install, and copies .mjs files into the target directory. Although it prints status messages, it does not warn the user before making these filesystem changes or installing dependencies, which are safety-relevant operations in a setup script.
- Content
Static analysis
No suspicious patterns detected.